ACL cyber

// establish an SSH session

C:\>ssh -l SSHadmin 192.168.2.1

R2#

//Apply ACL 10 to ingress traffic on the VTY lines.

R1#config t

R1(config)#access-list 10 permit host 192.168.3.3

R1(config)#line vty 0 4

R1(config-line)#access-class 10 in

R1(config-line)#exit

//Configure ACL 120 to specifically permit and deny the specified traffic.

R1#config t

R1(config)#access-list 120 permit udp any host 192.168.1.3 eq domain

R1(config)#access-list 120 permit tcp any host 192.168.1.3 eq smtp

R1(config)#access-list 120 permit tcp any host 192.168.1.3 eq ftp

R1(config)#access-list 120 deny tcp any host 192.168.1.3 eq 443

R1(config)#access-list 120 permit tcp host 192.168.3.3 host 10.1.1.1 eq 22

R1(config)#interface S0/0/0

R1(config-if)#ip access-group 120 in

R1(config-if)#exit

R1(config)#show access-list

R1(config)#end

R1#show access-list

Standard IP access list 10

10 permit host 192.168.3.3

Extended IP access list 120

10 permit udp any host 192.168.1.3 eq domain

20 permit tcp any host 192.168.1.3 eq smtp

30 permit tcp any host 192.168.1.3 eq ftp

40 deny tcp any host 192.168.1.3 eq 443

50 permit tcp host 192.168.3.3 host 10.1.1.1 eq 22

//Make any necessary changes to ACL 120 to permit and deny the specified traffic.

R1(config)#access-list 120 permit icmp any any echo-reply

R1(config)#access-list 120 permit icmp any any unreachable

R1(config)#access-list 120 deny icmp any any

R1(config)#access-list 120 permit ip any any

R1(config)#exit

R1#show access

Standard IP access list 10

10 permit host 192.168.3.3

Extended IP access list 120

10 permit udp any host 192.168.1.3 eq domain

20 permit tcp any host 192.168.1.3 eq smtp

30 permit tcp any host 192.168.1.3 eq ftp

40 deny tcp any host 192.168.1.3 eq 443 (44 match(es))

50 permit tcp host 192.168.3.3 host 10.1.1.1 eq 22

60 permit icmp any any echo-reply

70 permit icmp any any unreachable

80 deny icmp any any

90 permit ip any any

//Configure ACL 110 to permit only traffic from the inside network.

R3(config)#access-list 110 permit ip 192.168.3.0 0.0.0.255 any

//Apply the ACL to interface G0/1.

R3(config)#interface g0/1

R3(config-if)#ip access-group 110 in

R3(config-if)#end

//Configure ACL 100 to block all specified traffic from the outside network.

R3#config t

R3(config)#access-list 100 permit tcp 10.0.0.0 0.255.255.255 eq 22 host 192.168.3.3

R3(config)#access-list 100 deny ip 10.0.0.0 0.255.255.255 any

R3(config)#access-list 100 deny ip 172.16.0.0 0.15.255.255 any

R3(config)#access-list 100 deny ip 192.168.0.0 0.0.255.255 any

R3(config)#access-list 100 deny ip 127.0.0.0 0.255.255.255 any

R3(config)#access-list 100 deny ip 224.0.0.0 15.255.255.255 any

R3(config)#access-list 100 permit ip any any

R3(config)#interface s0/0/1

R3(config-if)#ip access-group 100 in

R3(config-if)#do show access-list

Standard IP access list 10

10 permit host 192.168.3.3

Extended IP access list 110

10 permit ip 192.168.3.0 0.0.0.255 any

Extended IP access list 100

10 permit tcp 10.0.0.0 0.255.255.255 eq 22 host 192.168.3.3

20 deny ip 10.0.0.0 0.255.255.255 any

30 deny ip 172.16.0.0 0.15.255.255 any

40 deny ip 192.168.0.0 0.0.255.255 any

50 deny ip 127.0.0.0 0.255.255.255 any

60 deny ip 224.0.0.0 15.255.255.255 any

70 permit ip any any